Overview

overview

10

Static

static

3

ed9bca91d9...fa.exe

windows7-x64

10

ed9bca91d9...fa.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-12-2023 16:23

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ed9bca91d9f76e0e99e9d9790e6369fa.exe

  • Size

    350KB

  • MD5

    ed9bca91d9f76e0e99e9d9790e6369fa

  • SHA1

    82ffc37c0c0df5930581ad4e941baba6be924cc7

  • SHA256

    ee7c511f8ed208e13637dbd35e997fe7517bc7f39ae47bf8e0622170b0269de9

  • SHA512

    62227820240490ba3c4067da549c8bde8053382a343f140551a485a0d689e4e3150d9c3c62b7f96de2f35816c1bef98b63c56827326540a28b1f7933bf93855e

  • SSDEEP

    6144:HDKW1Lgbdl0TBBvjc/JV5vwfGWWU+MSa5XW07pggy3LgWZTcGO8Vi8S7XoWdamQ:jh1Lk70Tnvjc1wflzXt+gy9hltS7vMH

Score
10/10
ploutusatmbackdoor

Malware Config

Signatures

  • Detected Ploutus loader 1 IoCs
  • Ploutus

    Ploutus is an ATM malware written in C#.

    backdooratmploutus

Processes

  • C:\Users\Admin\AppData\Local\Temp\ed9bca91d9f76e0e99e9d9790e6369fa.exe
    "C:\Users\Admin\AppData\Local\Temp\ed9bca91d9f76e0e99e9d9790e6369fa.exe"
    1⤵
      PID:4604

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/4604-2-0x0000000004C10000-0x0000000004C20000-memory.dmp
      Filesize

      64KB

      Download
    • memory/4604-4-0x0000000004C10000-0x0000000004C20000-memory.dmp
      Filesize

      64KB

      Download
    • memory/4604-3-0x0000000004C10000-0x0000000004C20000-memory.dmp
      Filesize

      64KB

      Download
    • memory/4604-1-0x0000000074B40000-0x00000000752F0000-memory.dmp
      Filesize

      7.7MB

      Download
    • memory/4604-0-0x00000000025C0000-0x0000000002628000-memory.dmp
      Filesize

      416KB

      Download
    • memory/4604-6-0x0000000004B40000-0x0000000004BA6000-memory.dmp
      Filesize

      408KB

      Download
    • memory/4604-7-0x0000000004C10000-0x0000000004C20000-memory.dmp
      Filesize

      64KB

      Download
    • memory/4604-8-0x0000000005380000-0x0000000005412000-memory.dmp
      Filesize

      584KB

      Download
    • memory/4604-5-0x0000000004C20000-0x00000000051C4000-memory.dmp
      Filesize

      5.6MB

      Download
    • memory/4604-10-0x0000000074B40000-0x00000000752F0000-memory.dmp
      Filesize

      7.7MB

      Download